SeCaptureSid

NTSTATUS __stdcall SeCaptureSid(PVOID InputSid, INT8 RequestorMode, UINT8 ForceCapture, PVOID *CapturedSid){
  __int64 v5; 
  int v6; 
  int v7; 
  unsigned int v8; 
  char *v9; 
  unsigned int v10; 
  UINT8 *PoolWithTag; 
  PVOID v12; 
  char v14; 
  PVOID *v15; 
  if( RequestorMode )
  {
    v5 = (__int64)InputSid + 1;
    if( (unsigned __int64)InputSid + 1 >= 0x7FFFFFFF0000i64 )
      v5 = 0x7FFFFFFF0000i64;
    v6 = *(unsigned __int8 *)v5;
    LOBYTE(v7) = v6;
    v8 = 4 * v6 + 8;
    if( 4 * v6 != -8 )
    {
      if( ((unsigned __int8)InputSid & 3) != 0 )
        ExRaiseDatatypeMisalignment();
      v9 = (char *)InputSid + v8;
      if( (unsigned __int64)v9 > 0x7FFFFFFF0000i64 || v9 < InputSid )
        MEMORY[0x7FFFFFFF0000] = 0;
    }
  }
  else
  {
    if( !v14 )
    {
      *v15 = InputSid;
      return 0;
    }
    v7 = *((unsigned __int8 *)InputSid + 1);
    v8 = 4 * v7 + 8;
  }
  v10 = v8;
  PoolWithTag = (UINT8 *)ExAllocatePoolWithTag(PagedPool, v8, 0x69536553ui64);
  *v15 = PoolWithTag;
  if( !PoolWithTag )
    return -1073741670;
  memmove(PoolWithTag, (UINT8 *)InputSid, v10);
  *((_BYTE *)*v15 + 1) = v7;
  v12 = *v15;
  if( RtlValidSid(*v15) )
    return 0;
  ExFreePoolWithTag(v12, 0);
  *v15 = 0i64;
  return -1073741704;
}

Referenced by: